u/StigaPower

Love this song so fucking much, this record from The Acacia Strain is among the top 5 from 2025 I'd say!

Hi there, let me give you the current status for my Secure Boot management:

• Secure Boot cert on device updated to 2023 - DONE (GPO deployment)
• SVN updated on device - DONE (Powershell applicaton, take on the available from github)
• 2011 CA placed in DBX - DONE (Powershell applicaton, take on the available from github)
• Boot image updated in SCCM by ticking the "Use Windows Boot Loader signed with Windows UEFI CA 2023" and redistribute content - DONE
• Test PXE-boot to validate functionality - DONE

Now to the part where I'm confused.
The boot image efi files all have expiring certificate 2026-05-15. I am running ADK 26100.2454 as its the latest supported for SCCM.

Why does the certificate expire on just a couple of weeks? What will happen when trying to boot on an expired certificate for 2023 CA?

I've tried to see if I can prolong the certificate expiration date by downloading the latest available ISO from M365 Admin center (2026-03) and running the script provided by Microsoft to make UEFI CA 2023 signed boot media (Make2023BootableMedia.ps1) but it still only grants certificate validity to 2026-05-15 and states that it was issues 2025-05-15.

This Secure Boot certificate expiration management from Microsoft has been utter shit, documentation is just pointing to different websites in a loop and it's really frustrating.

TLDR;
Why does the .efi-files in my boot.wim signed with CA 2023 have a validity date 2025-05-15 to 2026-05-15?

/ Frustrated system manager